Mantenimiento Web Vulnerabilities

The Mantenimiento web plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.8. This is due to missing or incorrect nonce validation on the vista_configuracion() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malici...

CVSS:

6.1

Affected:

up to 0.8

Fixed in:

0.9

Disclosed:

Oct 31, 2022

CVE-2022-38075 on NVD →

The Mantenimiento web plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 0.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts i...

CVSS:

5.5

Affected:

up to 0.13

Fixed in:

0.14

Disclosed:

Oct 20, 2022

CVE-2022-41980 on NVD →